Wardyn

Violations

Every contract breach across all actors. Each record links back to the actor's contract.

Highsoft
login volume of 9 in 60m is 3× this actor's normal upper bound (p95 3/h, median 2)
Userlogan@techopspartners.com
Sep 14, 10:25
Actor: logan@techopspartners.com (user)
Observed
{
  "spikes": [
    {
      "p95": 3,
      "count": 9,
      "ratio": 3,
      "median": 2,
      "robustZ": 4.72,
      "category": "login"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "login": {
    "p95": 3,
    "median": 2
  }
}
Why this is unusual
  • login: 9 vs p95 3 (3× normal upper bound)+100
Baseline confidence: 100%
Disposition
Highsoft
login volume of 7 in 60m is 3.5× this actor's normal upper bound (p95 2/h, median 1)
Usermarcus@serpamedia.com
Sep 13, 16:00
Actor: marcus@serpamedia.com (user)
Observed
{
  "spikes": [
    {
      "p95": 2,
      "count": 7,
      "ratio": 3.5,
      "median": 1,
      "robustZ": 4.05,
      "category": "login"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "login": {
    "p95": 2,
    "median": 1
  }
}
Why this is unusual
  • login: 7 vs p95 2 (3.5× normal upper bound)+100
Baseline confidence: 100%
Disposition
Mediumsoft
3 action(s) well outside this actor's working hours — at 10:00 UTC
Usersschwartzbach@techopspartners.com
Sep 10, 06:15
Actor: sschwartzbach@techopspartners.com (user)
Observed
{
  "offHoursUTC": [
    10
  ],
  "offHoursCount": 3,
  "hoursBeyondGrace": 3
}
Expected
{
  "graceHours": 3,
  "workingHoursUTC": "16:00–20:00"
}
Why this is unusual
  • 3 actions up to 3h beyond this actor's established working hours (16:00–20:00 UTC, with ±3h allowed for early starts / late finishes) — sustained activity this far outside normal hours can signal a compromised account or unattended automation+30
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (174.48.49.0/24)
Useralerting@techopspartners.com
Sep 3, 11:45
Actor: alerting@techopspartners.com (user)
Observed
{
  "exampleIp": "174.48.49.5",
  "newNetworks": [
    "174.48.49.0/24"
  ]
}
Expected
{
  "knownNetworks": [
    "73.56.31.0/24",
    "174.48.18.0/24",
    "98.211.244.0/24"
  ],
  "baselineLogins": 100
}
Why this is unusual
  • Source network not in the actor's 3 known login networks+80
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (174.48.49.0/24)
Usermarcus@serpamedia.com
Sep 3, 11:45
Actor: marcus@serpamedia.com (user)
Observed
{
  "exampleIp": "174.48.49.5",
  "newNetworks": [
    "174.48.49.0/24"
  ]
}
Expected
{
  "knownNetworks": [
    "98.211.244.0/24",
    "73.56.31.0/24",
    "174.48.18.0/24"
  ],
  "baselineLogins": 36
}
Why this is unusual
  • Source network not in the actor's 3 known login networks+80
Baseline confidence: 100%
Disposition
Highsoft
This actor's action mix has shifted from its baseline (~96% of its activity profile changed)
Usermarcus@coya-hc.com
Sep 3, 10:55
Actor: marcus@coya-hc.com (user)
Observed
{
  "recentMix": {
    "admin": 1
  },
  "tvDistance": 0.958,
  "recentEvents": 37
}
Expected
{
  "baselineMix": {
    "admin": 0.0415,
    "calendar": 0.0019,
    "auth_grant": 0.9547,
    "auth_revoke": 0.0019
  }
}
Why this is unusual
  • admin share rose 4% → 100%+96
Baseline confidence: 100%
Disposition
Infosoft
Accessed resource type(s) never seen in this actor's baseline: group
Usermarcus@coya-hc.com
Sep 3, 10:25
Actor: marcus@coya-hc.com (user)
Observed
{
  "newResourceTypes": [
    "group"
  ]
}
Expected
{
  "knownResourceTypes": [
    "oauth_token",
    "admin_action",
    "authentication",
    "calendar_event"
  ]
}
Why this is unusual
  • First-time access to resource type(s) group — an actor reaching new kinds of data can indicate scope creep or misuse+40
Baseline confidence: 100%
Disposition
Highsoft
admin volume of 21 in 60m is 3× this actor's normal upper bound (p95 7/h, median 2)
Usermarcus@coya-hc.com
Sep 3, 10:25
Actor: marcus@coya-hc.com (user)
Observed
{
  "spikes": [
    {
      "p95": 7,
      "count": 21,
      "ratio": 3,
      "median": 2,
      "robustZ": 12.82,
      "category": "admin"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "admin": {
    "p95": 7,
    "median": 2
  }
}
Why this is unusual
  • admin: 21 vs p95 7 (3× normal upper bound)+100
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (187.124.147.0/24)
Userlogan@techopspartners.com
Aug 17, 16:05
Actor: logan@techopspartners.com (user)
Observed
{
  "exampleIp": "187.124.147.39",
  "newNetworks": [
    "187.124.147.0/24"
  ]
}
Expected
{
  "knownNetworks": [
    "73.56.31.0/24",
    "98.211.244.0/24",
    "67.213.112.0/24",
    "174.48.18.0/24"
  ],
  "baselineLogins": 101
}
Why this is unusual
  • Source network not in the actor's 4 known login networks+80
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (174.48.49.0/24)
Usermarcus@coya-hc.com
Aug 14, 12:20
Actor: marcus@coya-hc.com (user)
Observed
{
  "exampleIp": "174.48.49.5",
  "newNetworks": [
    "174.48.49.0/24"
  ]
}
Expected
{
  "knownNetworks": [
    "73.56.31.0/24",
    "98.211.244.0/24",
    "174.48.18.0/24"
  ],
  "baselineLogins": 18
}
Why this is unusual
  • Source network not in the actor's 3 known login networks+80
Baseline confidence: 100%
Disposition
Lowsoft
4 action(s) well outside this actor's working hours — at 22:00 UTC
Userdispatch@techopspartners.com
Aug 4, 18:05
Actor: dispatch@techopspartners.com (user)
Observed
{
  "offHoursUTC": [
    22
  ],
  "offHoursCount": 4,
  "hoursBeyondGrace": 1
}
Expected
{
  "graceHours": 3,
  "workingHoursUTC": "11:00–18:00"
}
Why this is unusual
  • 4 actions up to 1h beyond this actor's established working hours (11:00–18:00 UTC, with ±3h allowed for early starts / late finishes) — sustained activity this far outside normal hours can signal a compromised account or unattended automation+22
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (2600:1006:b0aa:e0d1::/64)
Useraddison@coya-hc.com
Jul 28, 11:35
Actor: addison@coya-hc.com (user)
Observed
{
  "exampleIp": "2600:1006:b0aa:e0d1:a115:e07:1c16:5843",
  "newNetworks": [
    "2600:1006:b0aa:e0d1::/64"
  ]
}
Expected
{
  "knownNetworks": [
    "73.56.31.0/24",
    "2600:1006:b205:5ff9::/64",
    "174.48.18.0/24"
  ],
  "baselineLogins": 101
}
Why this is unusual
  • Source network not in the actor's 3 known login networks+80
Baseline confidence: 100%
Disposition
Infosoft
Accessed resource type(s) never seen in this actor's baseline: drive_file
Userlogan@techopspartners.com
Jul 21, 07:20
Actor: logan@techopspartners.com (user)
Observed
{
  "newResourceTypes": [
    "drive_file"
  ]
}
Expected
{
  "knownResourceTypes": [
    "authentication"
  ]
}
Why this is unusual
  • First-time access to resource type(s) drive_file — an actor reaching new kinds of data can indicate scope creep or misuse+40
Baseline confidence: 100%
Disposition
Mediumsoft
3 action(s) well outside this actor's working hours — at 10:00 UTC
Agent511566560828-23utloam4ek35i5n4grb870kucdva5fu.apps.googleusercontent.com
Jul 21, 06:25
Actor: 511566560828-23utloam4ek35i5n4grb870kucdva5fu.apps.googleusercontent.com (agent)
Observed
{
  "offHoursUTC": [
    10
  ],
  "offHoursCount": 3,
  "hoursBeyondGrace": 5
}
Expected
{
  "graceHours": 3,
  "workingHoursUTC": "18:00–20:00"
}
Why this is unusual
  • 3 actions up to 5h beyond this actor's established working hours (18:00–20:00 UTC, with ±3h allowed for early starts / late finishes) — sustained activity this far outside normal hours can signal a compromised account or unattended automation+42
Baseline confidence: 100%
Disposition
Mediumsoft
4 action(s) well outside this actor's working hours — at 10:00 UTC
Userlogan@techopspartners.com
Jul 21, 06:15
Actor: logan@techopspartners.com (user)
Observed
{
  "offHoursUTC": [
    10
  ],
  "offHoursCount": 4,
  "hoursBeyondGrace": 3
}
Expected
{
  "graceHours": 3,
  "workingHoursUTC": "16:00–00:00"
}
Why this is unusual
  • 4 actions up to 3h beyond this actor's established working hours (16:00–00:00 UTC, with ±3h allowed for early starts / late finishes) — sustained activity this far outside normal hours can signal a compromised account or unattended automation+34
Baseline confidence: 100%
Disposition
Highsoft
This actor's action mix has shifted from its baseline (~68% of its activity profile changed)
Usermarcus@techopspartners.com
Jul 16, 13:45
Actor: marcus@techopspartners.com (user)
Observed
{
  "recentMix": {
    "calendar": 0.8,
    "file_read": 0.2
  },
  "tvDistance": 0.683,
  "recentEvents": 30
}
Expected
{
  "baselineMix": {
    "meet": 0.003,
    "calendar": 0.1175,
    "file_read": 0.8795
  }
}
Why this is unusual
  • calendar share rose 12% → 80%+68
Baseline confidence: 100%
Disposition
Infosoft
Accessed resource type(s) never seen in this actor's baseline: drive_file
Usermarcus@serpamedia.com
Jul 14, 14:15
Actor: marcus@serpamedia.com (user)
Observed
{
  "newResourceTypes": [
    "drive_file"
  ]
}
Expected
{
  "knownResourceTypes": [
    "admin_action",
    "authentication"
  ]
}
Why this is unusual
  • First-time access to resource type(s) drive_file — an actor reaching new kinds of data can indicate scope creep or misuse+40
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (2401:4900:1f29:f056::/64)
Usermarcus@techopspartners.com
Jul 13, 18:20
Actor: marcus@techopspartners.com (user)
Observed
{
  "exampleIp": "2401:4900:1f29:f056:a0c0:5086:958d:ec9c",
  "newNetworks": [
    "2401:4900:1f29:f056::/64"
  ]
}
Expected
{
  "knownNetworks": [
    "73.56.31.0/24",
    "98.211.244.0/24"
  ],
  "baselineLogins": 6
}
Why this is unusual
  • Source network not in the actor's 2 known login networks+80
Baseline confidence: 100%
Disposition
Highsoft
calendar volume of 12 in 60m is 3× this actor's normal upper bound (p95 4/h, median 4)
Usermanagedhelpdesk@techopspartners.com
Jul 9, 11:10
Actor: managedhelpdesk@techopspartners.com (user)
Observed
{
  "spikes": [
    {
      "p95": 4,
      "count": 12,
      "ratio": 3,
      "median": 4,
      "robustZ": 5.4,
      "category": "calendar"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "calendar": {
    "p95": 4,
    "median": 4
  }
}
Why this is unusual
  • calendar: 12 vs p95 4 (3× normal upper bound)+100
Baseline confidence: 100%
Disposition
Mediumsoft
file_read volume of 23 in 60m is 2.3× this actor's normal upper bound (p95 10/h, median 4)
Userbrittany@techopspartners.com
Jul 6, 11:20
Actor: brittany@techopspartners.com (user)
Observed
{
  "spikes": [
    {
      "p95": 10,
      "count": 23,
      "ratio": 2.3,
      "median": 4,
      "robustZ": 4.27,
      "category": "file_read"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "file_read": {
    "p95": 10,
    "median": 4
  }
}
Why this is unusual
  • file_read: 23 vs p95 10 (2.3× normal upper bound)+77
Baseline confidence: 100%
Disposition
Lowsoft
file_read volume of 11 in 60m is 1.6× this actor's normal upper bound (p95 7/h, median 3)
Usermarlon@techopspartners.com
Jul 4, 00:15
Actor: marlon@techopspartners.com (user)
Observed
{
  "spikes": [
    {
      "p95": 7,
      "count": 11,
      "ratio": 1.6,
      "median": 3,
      "robustZ": 5.4,
      "category": "file_read"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "file_read": {
    "p95": 7,
    "median": 3
  }
}
Why this is unusual
  • file_read: 11 vs p95 7 (1.6× normal upper bound)+53
  • Sensitivity increased 0.9× for this actor from prior true-positive labels — volume bar lowered (3.5 → 3.1)0
Baseline confidence: 100%
Disposition
Mediumsoft
6 action(s) well outside this actor's working hours — at 04:00 UTC
Usermarlon@techopspartners.com
Jul 4, 00:05
Actor: marlon@techopspartners.com (user)
Observed
{
  "offHoursUTC": [
    4
  ],
  "offHoursCount": 6,
  "hoursBeyondGrace": 4
}
Expected
{
  "graceHours": 3,
  "workingHoursUTC": "12:00–21:00"
}
Why this is unusual
  • 6 actions up to 4h beyond this actor's established working hours (12:00–21:00 UTC, with ±3h allowed for early starts / late finishes) — sustained activity this far outside normal hours can signal a compromised account or unattended automation+48
Baseline confidence: 100%
Disposition
Lowsoft
auth_grant volume of 9 in 60m is 1.8× this actor's normal upper bound (p95 5/h, median 3)
Agent114967032103500438443
Jul 3, 03:00
Actor: 114967032103500438443 (agent)
Observed
{
  "spikes": [
    {
      "p95": 5,
      "count": 9,
      "ratio": 1.8,
      "median": 3,
      "robustZ": 4.05,
      "category": "auth_grant"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "auth_grant": {
    "p95": 5,
    "median": 3
  }
}
Why this is unusual
  • auth_grant: 9 vs p95 5 (1.8× normal upper bound)+60
Baseline confidence: 100%
Disposition
Lowsoft
file_read volume of 30 in 60m is 1.6× this actor's normal upper bound (p95 19/h, median 3)
Usermarcus@techopspartners.com
Jul 2, 14:45
Actor: marcus@techopspartners.com (user)
Observed
{
  "spikes": [
    {
      "p95": 19,
      "count": 30,
      "ratio": 1.6,
      "median": 3,
      "robustZ": 9.11,
      "category": "file_read"
    }
  ],
  "windowMinutes": 60
}
Expected
{
  "file_read": {
    "p95": 19,
    "median": 3
  }
}
Why this is unusual
  • file_read: 30 vs p95 19 (1.6× normal upper bound)+53
  • Sensitivity increased 0.989× for this actor from prior true-positive labels — volume bar lowered (3.5 → 3.5)0
Baseline confidence: 100%
Disposition
Infosoft
Accessed resource type(s) never seen in this actor's baseline: authentication
Usersschwartzbach@techopspartners.com
Jul 2, 14:05
Actor: sschwartzbach@techopspartners.com (user)
Observed
{
  "newResourceTypes": [
    "authentication"
  ]
}
Expected
{
  "knownResourceTypes": [
    "meeting",
    "calendar_event"
  ]
}
Why this is unusual
  • First-time access to resource type(s) authentication — an actor reaching new kinds of data can indicate scope creep or misuse+40
Baseline confidence: 100%
Disposition
Mediumsoft
Login from a network this actor has never authenticated from (2607:fb90:908e:4c10::/64)
Usermarlon@techopspartners.com
Jul 2, 14:05
Actor: marlon@techopspartners.com (user)
Observed
{
  "exampleIp": "2607:fb90:908e:4c10:61df:db9a:7e9b:6a56",
  "newNetworks": [
    "2607:fb90:908e:4c10::/64"
  ]
}
Expected
{
  "knownNetworks": [
    "98.211.244.0/24",
    "2a0a:a701:a000:aad7::/64"
  ],
  "baselineLogins": 17
}
Why this is unusual
  • Source network not in the actor's 2 known login networks+80
Baseline confidence: 100%
Disposition
Infosoft
Accessed resource type(s) never seen in this actor's baseline: meeting
Usermarlon@techopspartners.com
Jul 2, 14:05
Actor: marlon@techopspartners.com (user)
Observed
{
  "newResourceTypes": [
    "meeting"
  ]
}
Expected
{
  "knownResourceTypes": [
    "drive_file",
    "chat_message",
    "authentication"
  ]
}
Why this is unusual
  • First-time access to resource type(s) meeting — an actor reaching new kinds of data can indicate scope creep or misuse+40
Baseline confidence: 100%
Disposition